REM: Visualizing the Ripple Effect on Dependencies Using Metrics of Health

In recent years, free and open source software (FOSS) components have become common dependencies in the development of software, both open source and proprietary. As the complexity of software increases, so does the number of components they depend upon; in addition, components are also depending on other components. Thus, their dependency graphs are growing in size and complexity. One of the current challenges in software development is that it is not trivial to know the full dependency graph of an application. Developers are usually aware of the direct dependencies their application requires, but might not be fully aware of the dependencies that those dependencies require (the transitive dependencies). Unfortunately, transitive dependencies can break any software application; therefore, project developers need tools, methods and visualizations to inspect the health of these transitive dependencies and their potential impact.In this work, we propose the Ripple Effect of Metrics (REM) dependency graphs, a visualization of dependency graphs that leverages metrics of the health of dependencies. The two main features of REM dependency graph are: first, to display, and potentially summarize, the full dependency graph of an application based on the health of each of its dependencies; and second, to evaluate the ripple effect of potentially risky dependencies on the rest of the dependency graph. The REM helps application developers inspect the health of all of its dependencies, and also the impact that some of these dependencies might have. By showcasing two examples of popular NPM JavaScript application, we demonstrate that the combination of the ripple effect on the dependency graph using health metrics activity can be beneficial to developers. The advantages of REM graphs are: 1) the metric of health annotation is useful for evaluating the health of dependencies, and 2) the ripple effect of a vulnerability provides an easy method to identify potential risk in a dependency chain and 3) the summarizing mechanisms of the REM help reduce the size and complexity of the large dependency graphs, while focusing in specific aspects of the health of the dependency graph.